jetmonsters JetFormBuilder — Dynamic Blocks Form Builder.

JetFormBuilder <= 3.6.2 - Missing Authorization to Unauthenticated JetEngine Options Page Modification

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Broken access control

JetFormBuilder <= 3.6.6 - Reflected DOM-Based Cross-Site Scripting via 'query_var' Dynamic Preset via data-jfb-macro / JFB_FIELD:: Macro Renderer

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Cross-site scripting (XSS)

JetFormBuilder <= 3.6.5.4 - Unauthenticated Stored Cross-Site Scripting via 'choice' Post Meta via Insert/Update Post Action

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Cross-site scripting (XSS)

JetFormBuilder <= 3.6.5.3 - Reflected Cross-Site Scripting via 'jfb_xss' (URL Query Variable) Parameter via Calculated Field

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Cross-site scripting (XSS)

JetFormBuilder <= 3.6.2 - Unauthenticated Privilege Escalation via '_jet_engine_booking_form_id' Parameter

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Privilege escalation

JetFormBuilder <= 3.6.3 - Missing Authorization to Unauthenticated Sensitive Information Disclosure via 'context' Parameter

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Broken access control

JetFormBuilder <= 3.5.6.2 - Unauthenticated Arbitrary File Read via Media Field

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Path traversal

JetFormBuilder <= 3.5.3 - Missing Authorization to Unauthenticated Form Generation

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Broken access control

JetFormBuilder <= 3.3.4.1 - Authenticated (Administrator+) Privilege Escalation

• jetmonsters JetFormBuilder — Dynamic Blocks Form Builder
• Privilege escalation